IED-OS is deployed into SIMATIC IPC Industrial Edge Devices during production. Operating system updates are highly recommended, and update is possible via Industrial Edge Management (IEM).
| Component | Purpose | Description |
|---|---|---|
| Trusted deployment | Trusted environment for first installation | The Edge Device is delivered with a fully installed Industrial Edge Device OS (IED-OS), secured by default from the manufacturer site |
| Secure Boot | Verified Boot artifacts | To align with UEFI BIOS, boot artifacts in the OS are digitally signed by Siemens. |
| IMA | Linux Integrity Measurement Architecture | OS artifacts include the Linux Integrity Measurement Architecture to guarantee the integrity of the loaded modules. |
| Measured Boot | Measure trusted boot and update channels | The measured boot checks the integrity of the whole boot chain and compares it with the trusted initial deployment. The fingerprints are stored in crypto hardware. |
| Encrypted Artifacts | Encrypt delivered software artifacts (SIMATIC IPC IED-OS software) that are used with Service Stick for maintenance | Delivered software update artifacts are encrypted before release. These encrypted artifacts can only be used via Service Stick. |
| Digitally signed software artifacts | Integrity and authenticity of the software artifacts | CMS (Cryptographic Message Syntax) signatures and dedicated Industrial Edge code signing certificates ensure that the code has not been corrupted and the origin of the software has not been altered. |
| Vulnerability Monitor | Follow up vulnerabilities for 3rd party software components | All used 3rd party software components are monitored automatically and planned to be updated for new releases. |
| System Update | Keep the system updated and secure with system failover design | Edge users are always notified to schedule and update system via IEM. System update is verified, failover system design is in place. |
| Virus Check | Check system is safe before release | All artifacts are put into virus check system before releasing them to production environment. |
| Disabled Access | Deny access into system via terminal | Edge users are not allowed to access the OS via virtual terminals & consoles. Access to the system is closed in the OS building process. |
| Removed SSH | Unable to access over SSH into system | SSH access is not included in the system. |
| Restricted Access to Hardware Management via OS | Deny unauthorized access to device builder services to maintain device | Device builder services provide an interface to manage device and collect hardware specific configurations. Only authorized edge services can access to these services. |
| Hard Reset | Delete security related data e.g., password etc. | Whenever the hard reset is triggered, it is ensured that all security-relevant information e.g., passwords are securely deleted from the device. |
| USB Protection | Auto mount disabled on USB devices | In the system, the auto-mount feature for USB device is disabled. If a new USB stick is detected, system only mounts USB sticks with label "USBONBOARD" with ‘exec’ option disabled to prevent the possibility of running a malicious binary. |